Exploring AWS Metasploit modules
Up until now, we have been using Metasploit to target hosts that fall within the scope of a pentest. Now, let's start to look at some of the AWS modules that we can use to enumerate and possibly attack AWS. For our purposes, let's say we were able to get credentials from the client. This will be part of a functional test. We want to see what we can leverage using the credentials.
To get started, let's spin up the vulnerable vsftpd instance that we attacked earlier and the Kali instance in the Pentest Playground VPC.
Now, we are going to do something a little different. This is a combination of a functional test and a black-box test. We will have stolen credentials but have no clue about the environment – so, we need to see whether we can find anything good!
Stealing user credentials
The first exercise we are going to go through is going to involve stealing credentials that belong to other AWS user accounts. These are...
